CVE-2022-50433: efi: ssdt: Don't free memory if ACPI table was loaded successfully
In the Linux kernel, the following vulnerability has been resolved:
efi: ssdt: Don't free memory if ACPI table was loaded successfully
Amadeusz reports KASAN use-after-free errors introduced by commit 3881ee0b1edc ("efi: avoid efivars layer when loading SSDTs from variables"). The problem appears to be that the memory that holds the new ACPI table is now freed unconditionally, instead of only when the ACPI core reported a failure to load the table.
So let's fix this, by omitting the kfree() on success.
Affected Software
Remediation
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
A local attacker needs low-privileged access. The issue is associated with loading SSDTs from EFI variables, where memory backing a newly loaded ACPI table may be freed even though the ACPI core successfully loaded it.
How can I determine whether a system is exhibiting the vulnerability?
The reported symptom is KASAN use-after-free errors during the EFI SSDT loading path. Systems that do not use KASAN may not emit those diagnostics even if the affected code path is reached.
What remediation is available?
A patch is available. The fix avoids calling kfree() when the ACPI core successfully loads the table, while retaining cleanup when table loading fails.